MISP Modules versions prior to 3.0.8 contain vulnerabilities in expansion modules that allow unsafe remote resource fetching. The html_to_markdown module accepted arbitrary HTTP(S) URLs without proper validation, enabling Server-Side Request Forgery (SSRF) to internal network resources. The qrcode module disabled TLS certificate verification when fetching remote images, risking man-in-the-middle attacks. These issues were fixed in version 3.0.8 by validating URL schemes, blocking local/private IP ranges, resolving hostnames before fetching, enforcing timeouts, and re-enabling TLS verification.